Re: Cross Realm HELP

[Jeremiah Martell <inlovewithgod@gmail.com>]

The error I get from ldapsearch is:

ldap_sasl_interactive_bind: Local error (-2)
   additional info: SASL(-1): generic failure: GSSAPI Error:
Miscellaneous failure (see text) (Server (krbtgt/.@REALMA.COM) unknown)

I've tried stracing and ldd'ing ldapsearch and I noticed that it's not linked to certain libraries I would think it would be.

A "native" ldapsearch I checked was linked to the following libraries:
libldap
liblber
libdl
libssl
libcrypto
libcrypt
libresolv
libc
libgssapi_krb5
libkrb5
libcom_err
libk5crypto
libz

However, the ldapsearch I build is only linked to the following libraries:
linux-gate
libpthread
libsasl2
libbind
libc
lib/ld-linux
libdl
libresolv
libnsl

Quite a difference. 

I'm guessing that I'm doing something wrong when I'm building heimdal, then cyrus-sasl, then openldap. 

My hiemdal steps:
(1) ./configure --with-openssl=/code/openssl-0.9.7c/ssl-inst
--with-openssl-lib=/code/openssl-0.9.7c/ssl-inst/lib
--with-openssl-include=/code/openssl-0.9.7c/ssl-inst/include
(2) make
(3) make install

My cyrus-sasl steps:
(1) ./configure --enable-gssapi=/usr/heimdal --with-openssl=/code/openssl-0.9.7c --with-gss_impl=heimdal --with-gnu-ld
(2) make
(3) make install

My openldap steps:
(1) ./configure --with-cyrus-sasl --with-tls
(2) make
(3) make install

Am I missing anything? Doing something strange or wrong?

  Thanks,
 - Jeremiah

On 10/12/05, Love Hörnquist Åstrand <lha@kth.se> wrote:

Jeremiah Martell <inlovewithgod@gmail.com> writes:

> I cannot kinit to realm B, and then use ldapsearch -Y GSSAPI to access
> the ldap directory in realm A. (Even though there's a trust between the
> realms B and A)
>
> However, I can first kinit to B, use kvno to manually get a ticket for
> the ldap directory in realm A (kvno ldap/domainA@realmA), and then use
> ldapsearch -Y GSSAPI to access the ldap directory in realm A.


Check KDC logs in realm B. check with tcpdump what the client tries to do.
What error do you get from ldapsearch ?

Love